firefox and system-wide installation/deployment of certificates

wanted to add CACert.org Root Certificate in firefox for all users on a system. it seems as if this were not possible...
(but see: http://wiki.cacert.org/wiki/NSSLib and https://bugzilla.mozilla.org/show_bug.cgi?id=215243)

however, one can use certutil to create a cert8.db and deploy that with the default profile - of course, that doesn't help with users who already have profiles...

certutil -N -d . 

certutil -A -n "SomeName" -t "C,C,C" -i some.crt -d .
and then copy cert8.db, key3.db and secmod.db to Firefox-Root-Dir/defaults/profile.

references:

1. http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html
2. http://kb.mozillazine.org/Profile_folder_-_Firefox
3. http://straxus.javadevelopersjournal.com/creating_a_mozillafirefox_drag_and_drop_file_upload_script_p_1.htm
4. http://open.itworld.com/5037/book_050425firefoxhacks/page_1.html